SB2026110376 - Multiple vulnerabilities in ZoneMinder
Published: November 3, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) OS Command Injection (CVE-ID: CVE-2026-102607)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary operating system commands on the server as the web server user (www-data).
The vulnerability exists due to improper neutralization of shell metacharacters in ZoneMinder's exportEvents() function in web/skins/classic/includes/export_functions.php when processing event export requests. A remote user can submit a request with View Events or View Snapshots permission and a valid __csrf_magic token, injecting shell metacharacters into the exportFile parameter to execute arbitrary operating system commands through PHP's exec().
When using non-existent event IDs, the request must include exportDetail=1 to prevent a PHP fatal error in exportEventImagesMaster().
2) OS Command Injection (CVE-ID: CVE-2026-76060)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary operating system commands as the web server user (www-data).
The vulnerability exists due to improper neutralization of shell metacharacters in web/includes/download_functions.php when constructing event export commands from a monitor's name. A remote user can set a monitor name such as poc'; <command>; echo ' using Monitors=Create or Monitors=Edit permission to execute arbitrary commands when a user with Events=View permission exports an event belonging to that monitor through the web interface or API. The name is incorporated into both the ffmpeg concatenation command and the archive command using single-quote wrapping that does not escape embedded quotes.
Remediation
Install update from vendor's website.